Skip to main content

Linux Kernel EUVDEUVD-2026-55453

| CVE-2026-68352 HIGH
2026-08-10 Linux GHSA-3chg-p6wm-r59m
Buffer Overflow Linux
8.3
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.3 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
vuln.today AI
8.3 HIGH

AV:A and PR:N are confirmed by the rogue-AP trigger model requiring no victim credentials; C:H and A:H reflect OOB kernel read enabling memory disclosure and crash.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 03:03 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
8.3 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 12:03 cve.org
HIGH 8.3
CVE Published
Aug 10, 2026 - 12:03 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath6kl: fix OOB read from firmware IE lengths in connect event

The firmware-controlled beacon_ie_len, assoc_req_len, and assoc_resp_len fields in ath6kl_wmi_connect_event_rx() are not validated against the buffer length. Their sum (up to 765) can exceed the actual WMI event data, causing out-of-bounds reads during IE parsing and state corruption of wmi->is_wmm_enabled.

Add a check that the total IE length fits within the buffer.

AnalysisAI

Out-of-bounds kernel memory read in the Linux kernel's ath6kl WiFi driver exposes systems with Atheros AR600x chipsets to kernel memory disclosure and availability impact via a malicious adjacent-network access point. The ath6kl_wmi_connect_event_rx() function fails to validate firmware-supplied beacon_ie_len, assoc_req_len, and assoc_resp_len fields against the actual WMI event buffer size before parsing 802.11 Information Elements, allowing combined lengths of up to 765 bytes to exceed the buffer boundary and corrupt the wmi->is_wmm_enabled state flag. No public exploit has been identified and the vulnerability is not listed in CISA KEV; EPSS at 0.21% (11th percentile) reflects minimal opportunistic exploitation activity consistent with the niche hardware footprint.

Technical ContextAI

The ath6kl kernel driver manages Atheros AR600x 802.11n WiFi chipsets, commonly embedded in IoT and legacy wireless devices, communicating with firmware via a proprietary WMI (Wireless Management Interface) event protocol. On a WiFi connect event, firmware delivers a structured event payload containing three length fields - beacon_ie_len, assoc_req_len, and assoc_resp_len - which the driver uses to locate and iterate over 802.11 Information Elements (IEs) within the same buffer. The root cause is a classic missing-bounds-check: none of these firmware-controlled length fields are validated against the remaining bytes in the received WMI event payload before pointer arithmetic and memory reads occur. Because each field can independently approach 255 bytes and their sum can reach 765, the driver can be made to read arbitrarily far past the end of the allocated kernel buffer. Secondary impact is state corruption: the wmi->is_wmm_enabled flag, which governs WMM (Wi-Fi Multimedia) QoS prioritization, can be overwritten with out-of-bounds data. ENISA EUVD tags the flaw as a Buffer Overflow class (more precisely an out-of-bounds read, CWE-125, though NVD lists CWE as N/A). CPE data identifies the affected product as cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* spanning from Linux 3.2 through multiple current stable branches.

RemediationAI

Upgrade to a patched Linux kernel stable release: 6.6.148, 6.12.101, 6.18.42, or 7.1.6 are confirmed fixed branches per ENISA EUVD data, with fixes traceable to git.kernel.org stable tree commits. Distribution maintainers (Debian, Ubuntu, RHEL, SUSE, and others) are expected to backport these fixes to their supported kernel streams; consult vendor-specific errata for distribution package versions. If immediate kernel upgrade is not feasible, the most effective compensating control is to blacklist the ath6kl kernel module by adding 'blacklist ath6kl' to /etc/modprobe.d/ and rebooting - this eliminates the attack surface entirely at the cost of losing Atheros AR600x WiFi functionality on the affected device, which may be acceptable on systems where the interface is unused. A secondary measure is restricting device wireless association to trusted, controlled access points via WPA-Enterprise or MAC-level network controls, which reduces adjacent-network attacker opportunity but does not eliminate the flaw if firmware communication can be manipulated through other means. No additional vendor advisory URL beyond git.kernel.org commits is available at time of analysis.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

EUVD-2026-55453 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy